FTC Issues Recommendations on Mobile Privacy

The report, aimed specifically at Amazon.com Inc., Apple Inc., BlackBerry, Google Inc. and Microsoft Corp., app developers (including retailers with mobile apps), advertising networks and analytics companies, and app developer trade associations, involves ensuring consumers get timely, easy-to-understand disclosures about what data the companies and developers collect and how they use the data.

“The mobile world is expanding and innovating at breathtaking speed, allowing consumers to do things that would have been hard to imagine only a few years ago,” says FTC chairman Jon Leibowitz. “These best practices will help to safeguard consumer privacy and build trust in the mobile marketplace, ensuring that the market can continue to thrive.”

The report says mobile technology raises special privacy concerns because consumers typically have the devices with them at all times. The FTC says that makes it possible to collect unprecedented amounts of data about individuals. In addition, since data collected from any mobile device may be shared among many entities, consumers may wonder where they should turn if they have questions about their privacy, the FTC adds.

Another FTC recommendation is that mobile platform providers should consider offering a “Do Not Track” mechanism for smartphone users to prevent tracking by ad networks or other third parties as they navigate among apps on their phones.

The FTC report also suggests mobile platforms should provide disclosures to consumers immediately before data would begin to be collected and obtain consumers’ affirmative express consent before allowing apps to access sensitive content like the individual’s location, contacts, photos, calendar entries, or the recording of audio or video content.

Plus, app developers (including retailers with mobile apps) should have a privacy policy and make sure it is easily accessible through the app stores. And developers should provide disclosures and obtain affirmative express consent before collecting and sharing sensitive information, to the extent the platforms have not already provided such disclosures and obtained such consent.